From f9d51b8681d108969fd1e8fd3719fe1e4fdcf5c2 Mon Sep 17 00:00:00 2001
From: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
Date: Sun, 15 Mar 2026 11:25:24 -0400
Subject: [PATCH] Move PyJWT floor to azure optional dependency group

---
 pyproject.toml | 4 ++--
 uv.lock        | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 1297f2698..f8fc5804c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -25,7 +25,6 @@ dependencies = [
     "jsonref>=1.1.0",
     "uncalled-for>=0.2.0",
     "watchfiles>=1.0.0",
-    "PyJWT>=2.12.0",
 ]
 
 requires-python = ">=3.10"
@@ -55,7 +54,8 @@ classifiers = [
 [project.optional-dependencies]
 anthropic = ["anthropic>=0.40.0"]
 apps = ["prefab-ui>=0.11.2"]
-azure = ["azure-identity>=1.16.0"]
+# PyJWT floor: transitive via msal; CVE-2026-32597 affects <= 2.11.0
+azure = ["azure-identity>=1.16.0", "PyJWT>=2.12.0"]
 code-mode = ["pydantic-monty>=0.0.8"]
 gemini = ["google-genai>=1.18.0"]
 openai = ["openai>=1.102.0"]
diff --git a/uv.lock b/uv.lock
index d43c012da..99a1d5ad6 100644
--- a/uv.lock
+++ b/uv.lock
@@ -780,7 +780,6 @@ dependencies = [
     { name = "platformdirs" },
     { name = "py-key-value-aio", extra = ["filetree", "keyring", "memory"] },
     { name = "pydantic", extra = ["email"] },
-    { name = "pyjwt" },
     { name = "pyperclip" },
     { name = "python-dotenv" },
     { name = "pyyaml" },
@@ -800,6 +799,7 @@ apps = [
 ]
 azure = [
     { name = "azure-identity" },
+    { name = "pyjwt" },
 ]
 code-mode = [
     { name = "pydantic-monty" },
@@ -867,7 +867,7 @@ requires-dist = [
     { name = "pydantic", extras = ["email"], specifier = ">=2.11.7" },
     { name = "pydantic-monty", marker = "extra == 'code-mode'", specifier = ">=0.0.8" },
     { name = "pydocket", marker = "extra == 'tasks'", specifier = ">=0.18.0" },
-    { name = "pyjwt", specifier = ">=2.12.0" },
+    { name = "pyjwt", marker = "extra == 'azure'", specifier = ">=2.12.0" },
     { name = "pyperclip", specifier = ">=1.9.0" },
     { name = "python-dotenv", specifier = ">=1.1.0" },
     { name = "pyyaml", specifier = ">=6.0,<7.0" },